Alissa Knight, CEO & Chief AI Officer at Assail, talks with Sean Martin about cloud cost and data exposure worries in offensive security testing. She says a small language model on customer hardware answers both, including in disconnected environments.
Alissa Knight, CEO & Chief AI Officer at Assail, says federal, military and large enterprise buyers raise two worries about running offensive cyber operations in the cloud: the cost of tokens and where vulnerability data ends up. Assail does not sell to small and midsize businesses.
Knight says Assail is the only adversarial exposure validation platform that gives the customer the entire application stack, including the AI model. She says it is a small language model, about 60 gigabytes with 31 billion parameters, that can run on hardware such as the RTX 6000 Pro, and that it now runs on both x86 and ARM. She also says competing wrappers around frontier models can report clean results when the real cause is a high rejection rate behind the scenes. These are her claims.
Sean asked for scenarios where the model needs to sit on premises. Knight says running disconnected has let Assail serve federal and military users in contested areas, and gives customers AI sovereignty and data sovereignty. Sean also asked what comes out the other side: she describes an interactive report in plain English with exploit evidence, a video of the attack, and patches.
The conversation matters for any team weighing offensive security tools: ask where the model runs, where findings go, and what a clean report actually means.
This is a Brand Highlight. A Brand Highlight is a ~5 minute introductory conversation designed to put a spotlight on the guest and their company. Learn more: https://www.studioc60.com/creation#highlight
GUEST
Alissa Knight, CEO & Chief AI Officer at Assail
On LinkedIn: https://www.linkedin.com/in/alissaknight/
More from Assail on ITSPmagazine: https://www.itspmagazine.com/blog?brand=assail
RESOURCES
Learn more about Assail: https://www.assailai.com/
Learn more about Assail Federal: https://assailfederal.com
▶︎ Want your brand on ITSPmagazine? Explore all of the options here: https://www.itspmagazine.com/advertise
KEYWORDS
Alissa Knight, Assail, Sean Martin, brand story, brand marketing, marketing podcast, brand highlight, Recorded On Location at ISC2 Security Congress, adversarial exposure validation, autonomous offensive security, small language model, on-premises AI, AI sovereignty, data sovereignty, disconnected environments, federal and military cybersecurity, offensive cyber operations
Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=assail-ships-its-own-ai-model-to-customers-keeping-vulnerability-data-out-of-the-cloud
Alissa Knight Assail Interview
Recorded 2026-11-04
With Alissa Valentina Knight, CEO & Chief AI Officer at Assail (not confirmed online); Sean Martin, Co-Founder and CTO at ITSPmagazine (not confirmed online)
Times are in the published episode: the conversation starts at 00:00:32, after the front bumper.
[00:00:55] Sean Martin: let's do huggers.
[00:00:57] Alissa Knight: alright.
[00:00:57] Sean Martin: So good to see you.
[00:00:58] Alissa Knight: Good to see you again too.
[00:00:59] Sean Martin: And to see all of this.
[00:01:02] Alissa Knight: I know. It's been, it's
[00:01:03] Sean Martin: super impressive.
[00:01:03] Alissa Knight: It's crazy. I've, I've never, so, as you know, I've started and sold multiple cybersecurity startups. I've never built a company so fast like this all happened in nine months. I was the keynote speaker last year in Nashville at ISC2 Security Congress. We had zero customer, zero revenue no funding. We had 300 signups when I was on the keynote stage. 100% of our revenue so far has been from people that attended last year's conference, so ISC2 has been a very successful venue for us.
[00:01:34] Sean Martin: That's
[00:01:34] Alissa Knight: good. Been for us. So
[00:01:34] Sean Martin: it's a great testament.
[00:01:35] Alissa Knight: Yeah.
[00:01:36] Sean Martin: Well, Alissa, it's great to see you.
[00:01:37] Alissa Knight: Thank you.
[00:01:38] Sean Martin: And. So we're gonna talk a little bit about some of the stuff you're seeing, some of the trends you're seeing.
[00:01:43] Alissa Knight: Yeah.
[00:01:43] Sean Martin: That led you to some announcements as well.
[00:01:46] Alissa Knight: Sure. Yeah.
[00:01:46] Sean Martin: So give us an overview of what you've been up to.
[00:01:48] Alissa Knight: Yeah. So we've, in meeting with federal, military, large enterprise, we don't sell to SMBs. The prevailing concern right now is prosecuting offensive cyber operations in the cloud. Tokens is a real concern for enterprises at the moment. We've talked to different types of organizations, different industries, not just government and military, but insurance, financial services, FinTech. There it is extremely cost prohibitive to prosecute offensive cyber in the cloud. And so as the only AEV platform that provides the customer the entire application stack, including the AI model, we are cornering the market right now. A lot of the other competing solutions out there are simply just wrappers to frontier models. So the wrappers to Claude, the wrappers to ChatGPT, they are sending your vulnerabilities to the cloud. I don't understand how that's ever been a thing, how that's even. Okay. And so with our platform customers get that AI sovereignty, they get that data sovereignty, and it also allows us to run in disconnected environments. So we don't have a connection to the internet. You can use our platform. So this has really, you run
[00:03:03] Sean Martin: on the field.
[00:03:04] Alissa Knight: Yeah. It's, it's allowed us to really sell into the federal military space to support the war fighter who is in contested areas. They don't have a connection to the internet. And because we're a small language model, we're only about 60 gigabytes in size with 31 billion parameters. You can really run us on anything that's got enough B ram. So you can run us on RTX 6000 Pro, you don't need to buy these expensive H100s, B100s. B300s for inference. As a matter of fact, we just ported our model to arm architecture, so we actually run native, the new Grace Blackwell chip. So we run on X 86 and arm as well.
[00:03:43] Sean Martin: Very cool. So I would imagine a lot of people kind of understand the importance of this,
[00:03:50] Alissa Knight: right?
[00:03:50] Sean Martin: And maybe give us a scenario or two where it's critical to have the model inside and on-prem
[00:03:56] Alissa Knight: Yeah.
[00:03:57] Sean Martin: In the area where you want it to be and not off somewhere else.
[00:03:59] Alissa Knight: Yeah, sure. So just. For your audience's edification. We're an adversarial exposure validation platform, so that's basically fancy marketing speak for an autonomous hacking platform. So I basically put myself out of a job. Right. As a pen tester.
[00:04:14] Sean Martin: It is you?
[00:04:15] Alissa Knight: Yeah. This is pretty much, yeah. I mean, all my 26 years of offensive experience in hacking APIs, web apps, we baked into JSONL files, which became QLoRA adapters for the model, and so. The reason why ha shipping our own AI model to the customer is, is important in several, several ways. Number one, you have a high rejection rate with those frontier models. So when a competing platform fill in the blank on who that is is reporting zero vulnerabilities. Sorry, I didn't find any vulnerabilities in the application. A lot of the times it's because of a rejection rate that's happening in the backend that they're not telling the customer. So because they're just the scaffolding or harness around that other model that they're borrowing, there's a high rejection rate with that. 'cause it's really difficult to go to something like Claude or ChatGPT, which has those guardrails baked in to say, I want you to attack my API swear this is legitimate. I own it. It's there's, you're still gonna get rejections,
[00:05:15] Sean Martin: right?
[00:05:15] Alissa Knight: So it's going to affect your findings and you're gonna get this false sense of security that. Hey, I'm not vulnerable. There's no vulnerabilities. Even AI couldn't hack me when in fact it was just because of a high rejection rate with a lot of those platforms.
[00:05:29] Sean Martin: So interesting. So you mentioned [00:05:00] kind of taking your brain, right? Putting in JSONL files there, you said.
[00:05:35] Alissa Knight: So yeah, so I mean, so JSONL files are effectively the recipe, if you will, for creating your QLoRA adapters, which is basically weight. So you're basically taking a model and you're fine tuning it. They're think of them like dial. So you're taking a base model and you're redialing its focus, I would say, or expertise. And for us it's offensive security. So we've cr effectively created training files, our own training files on this tacit knowledge or corpus of data on how to hack SCADA systems, industrial control systems drones embedded operating systems like Wind River that sort of thing that our connected world relies upon. So like, for example, the. VxWorks is the operating system for the Apache attack helicopter. It's in submarines, it's in the, you know, joint strike fighters. It's in all of these weapons systems. And it's an operating system. It's an embedded OS, and so our platform can hack those targets, so it gives the warfighter federal agencies who want to attack their own assets and also enterprise that wants to attack their own assets before the bad guy does. It's identifying the vulnerabilities. Exploiting them and being informed about those vulnerabilities before the bad guy finds 'em first.
[00:06:55] Sean Martin: And let's wrap with what comes out the other side. 'cause it's great to have findings.
[00:07:01] Alissa Knight: Yeah. You know,
[00:07:02] Sean Martin: maybe
[00:07:02] Alissa Knight: not great to have findings. Yeah. What do we do about it? Right. So the interesting thing is, so first and foremost we have post quantum encryption. So we shard our encryption keys up, making it impossible for a quantum computer to crack our encryption. So everyone, but. The outcome is an interactive report. It's explained in plain English, the findings. We provide all of the exploit response, so it's, you know, the days of just trust the vulnerability scanner are gone. We actually give the findings from the vulnerability we exploited, and so it really gives that user or operator the confidence that this is a real vulnerability, real findings. She's actually pilfering or capable of pilfering data from the target to prove that she was there. She also records a screen, so when she's attacking the target, you actually get a video of the attack. So, and then finally patches. So she will actually patch the vulnerability. She'll give the user the patch, the user can then provide that for their developers to actually patch the system. And the new Charlemagne release that we're releasing on December 31st. We're getting more into actually memory resident patches. So instead of modifying the source code or trying to patch the system, the application itself, especially when Ed doesn't have access to the code, you can create a patch that runs strictly in memory. Very
[00:08:26] Sean Martin: price mitigation. Yeah.
[00:08:27] Alissa Knight: Yeah. It's very cool.
[00:08:29] Sean Martin: Super cool. Well, I'm so excited for you.
[00:08:31] Alissa Knight: Thank you, [00:08:00] Sean.
[00:08:32] Sean Martin: Assail is a company.
[00:08:33] Alissa Knight: Yes.
[00:08:33] Sean Martin: And this is your name?
[00:08:34] Alissa Knight: Yeah. Yeah. You're
[00:08:35] Sean Martin: amazing
[00:08:36] Alissa Knight: that that was an accident, by the way. But yeah, so. Someone walked up to me and said, that's really cool what you did with the name. I was like, what are you talking about? You know it's an anagram for your name Alyssa. Right. I was like, I, no, I did not know that. And so you just said it. So yeah, it's actually from Sun Tzu's Art of War, the book. Exactly. And you know, it's something along the lines of, I'm gonna master this quote, but somewhere along the lines of, we don't anticipate, it's not that we're anticipating the enemy not coming, but that we've made our position unassailable. So it's unassailable. Yeah. To attack. I
[00:09:07] Sean Martin: love it. I'll tell folks how they can reach you.
[00:09:10] Alissa Knight: Yeah. So come visit our website. It is assail.ai.com. We spun our federal group off into Assail Federal, so that's assailfederal.com. And you can connect with me on the socials, like LinkedIn and X. So
[00:09:23] Sean Martin: do it. She's amazing. Thanks everybody.
[00:09:26] Alissa Knight: Appreciate it. Thank you. Awesome. Thanks Sean. Appreciate it's good seeing you again.
[00:09:30] Sean Martin: So